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This is in response to the appeal brief filed October 3, 2005 appealing from the Office 
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(1) Real Party in Interest 

A statement identifying by name the real party in interest is contained in the brief. 

(2) Related Appeals and Interferences 

The examiner is not aware of any related appeals, interferences, or judicial 
proceedings which will directly affect or be directly affected by or have a bearing on the 
Board's decision in the pending appeal. 

(3) Status of Claims 

The statement of the status of claims contained in the brief is correct. 

(4) Status of Amendments After Final 

The appellant's statement of the status of amendments after final rejection 
contained in the brief is correct. 

(5) Summary of Claimed Subject Matter 

The summary of claimed subject matter contained in the brief is correct. 

(6) Grounds of Rejection to be Reviewed on Appeal 

The appellant's statement of the grounds of rejection to be reviewed on appeal is 
correct. 
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(7) Claims Appendix 

The copy of the appealed claims contained in the Appendix to the brief is correct. 

(8) Evidence Relied Upon 

6,321,338 PORRAS 11-2001 

(9) Grounds of Rejection 

The following ground(s) of rejection are applicable to the appealed claims: 
Claims 1-34, 36-48 are rejected under 35 U.S.C. 102(e) as being anticipated by Porras 
et al. (hereinafter Porras), U.S. patent 6,321,338. 

In considering claim 1, Porras discloses a network comprising: A plurality of 
network nodes, (see Fig. 1 ); A plurality of routing devices to route network traffic 
between network nodes, (col. 3, lines 44-45); A director coupled to the routing devices 
to determine whether selected instances of source addresses of packets routed by the 
routing devices are spoof source addresses, based on consistency measures, (col. 1 , 
lines 43-53). 

In considering claim 2, the method of Porras provides a means for determining 
whether selected instances of source addresses of packets routed by the routing 
devices are spoof source addresses, based on spatial distribution profiles of source 
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addresses in view of a reference source address spatial distribution profile. See col. 5, 
lines 36-51 . 

In considering claim 3, the method of Porras provides a means for the reference 
source address spatial distribution profile to comprise a historical spatial distribution 
profile for a particular address. See col. 5, lines 38-40. 

In considering claim 4, the method of Porras provides a means for determining 
whether selected instances of source addresses of packets routed by the routing 
devices are spoof source addresses, based on destination source address range 
(DSAR) distribution profiles of the source addresses in view of a reference DSAR 
distribution profile. See col. 5, lines 36-51. 

In considering claim 5, the method of Porras provides a means for the reference 
DSAR distribution profile to comprise a historical DSAR distribution profile for a 
particular address. See col. 5, lines 38-40. 

In considering claim 6, the method of Porras provides a means for determining 
whether selected instances of source addresses of packets routed by the routing 
devices are spoof source addresses, based on migration distribution profiles of source 
addresses in view of a reference source address migration distribution profile. See col. 
5, lines 36-51. 
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In considering claim 7, the method of Porras provides a means for the reference 
source address migration distribution profile to comprise a historical migration 
distribution profile for a particular address. See col. 5, lines 38-40. 

In considering claim 8, the method of Porras provides a means for determining 
whether selected instances of source addresses of packets routed by the routing 
devices are spoof source addresses, based on timing distribution profiles of source 
addresses in view of a reference source address timing distribution profile. See col. 5, 
lines 36-51. 

In considering claim 9, the method of Porras provides a means for the reference 
source address timing distribution profile to comprise a historical timing distribution 
profile for a particular address. See col. 5, lines 38-40. 

In considering claim 10, the method of Porras teaches the director being 
equipped to determine whether filtering actions are to be taken amongst particular 
routing devices. See col. 9, lines 57-63. 

In considering claim 11, it is inherent in the method of Porras that the director 
takes into consideration, when making its determination, whether packets of non-spoof 
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instances of a source address having instances deemed to be spoof source addresses 
are likely to be routed in the network. See col. 9, lines 57-63. 

In considering claim 12, the method of Porras teaches a plurality of director 
devices cooperatively coupled to each other to jointly make determinations. See col. 3, 
lines 16-40. 

In considering claim 13, the method of Porras further teaches a plurality of 
sensors for monitoring and reporting source addresses of packets routed through 
routing devices. See col. 3, lines 42-45. 

In considering claim 14, the method of Porras further teaches sensors facilitating 
application of the desired source address based filtering on packets being routed 
through the routing devices. See col. 3, lines 55-65. 

In considering claim 15, Porras discloses a networking method comprising: 
Receiving information associated with source addresses of packets being routed to and 
from a plurality of network nodes, and determining whether selected instances of the 
source addresses are spoof instances based on consistency measures, (col. 1, lines 
43-53); Managing the network based, at least in part, on the results of the 
determination, (col. 1, lines 66-67, col. 2, lines 1-7). 
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In considering claim 16, the method of Porras provides a means for determining 
whether selected instances of source addresses of packets are spoof source 
addresses, based on spatial distribution profiles of source addresses in view of a 
reference source address spatial distribution profile. See col. 5, lines 36-51. 

In considering claim 17, the method of Porras further provides a means for 
constructing the spatial distribution profiles. See col. 5, lines 4-36. 

In considering claim 18, the method of Porras further provides a means for 
determining whether each of the spatial distribution profiles is within a resemblance 
tolerance limit when compared to each of the at least one reference source address 
spatial distribution profiles. See col. 5, lines 38-40. 

In considering claim 19, the method of Porras provides a means for the reference 
source address spatial distribution profile to comprise a historical spatial distribution 
profile for a particular address. See col. 5, lines 38-40. 

In considering claim 20, the method of Porras provides a means for determining 
whether selected instances of source addresses of packets are spoof source 
addresses, based on DSAR distribution profiles of source addresses in view of a 
reference source address DSAR distribution profile. See col. 5, lines 36-51. 



Application/Control Number: 09/777,550 Page 9 

Art Unit: 2151 

In considering claim 21 , the method of Porras further provides a means for 
constructing the DSAR distribution profiles. See col. 5, lines 4-36. 

In considering claim 22, the method of Porras further provides a means for 
determining whether each of the DSAR distribution profiles is within a resemblance 
tolerance limit when compared to each of the at least one reference source address 
DSAR distribution profiles. See col. 5, lines 38-40. 

In considering claim 23, the method of Porras provides a means for the reference 
source address DSAR distribution profile to comprise a historical DSAR distribution 
profile for a particular address. See col. 5, lines 38-40. 

In considering claim 24, the method of Porras provides a means for determining 
whether selected instances of source addresses of packets are spoof source 
addresses, based on migration distribution profiles of source addresses in view of a 
reference source address migration distribution profile. See col. 5, lines 36-51. 

In considering claim 25, the method of Porras further provides a means for 
constructing the migration distribution profiles. See col. 5, lines 4-36. 

In considering claim 26, the method of Porras further provides a means for 
determining whether each of the migration distribution profiles is within a resemblance 
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tolerance limit when compared to each of the at least one reference source address 
migration distribution profiles. See col. 5, lines 38-40. 

In considering claim 27, the method of Porras provides a means for the reference 
source address migration distribution profile to comprise a historical migration 
distribution profile for a particular address. See col. 5, lines 38-40. 

In considering claim 28, the method of Porras provides a means for determining 
whether selected instances of source addresses of packets are spoof source 
addresses, based on timing distribution profiles of source addresses in view of a 
reference source address timing distribution profile. See col. 5, lines 36-51. 

In considering claim 29, the method of Porras further provides a means for 
constructing the timing distribution profiles. See col. 5, lines 4-36. 

In considering claim 30, the method of Porras further provides a means for 
determining whether each of the timing distribution profiles is within a resemblance 
tolerance limit when compared to each of the at least one reference source address 
timing distribution profiles. See col. 5, lines 38-40. 
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In considering claim 31 , the method of Porras provides a means for the reference 
source address timing distribution profile to comprise a historical timing distribution 
profile for a particular address. See col. 5, lines 38-40. 

In considering claim 32, the method of Porras teaches, in managing the network, 
determining whether filtering actions are to be taken amongst particular routing devices. 
See col. 9, lines 57-63. 

In considering claim 33, it is inherent in the method of Porras when making the 
determination, to take into consideration whether packets of non-spoof instances of a 
source address having instances deemed to be spoof source addresses are likely to be 
routed in the network. See col. 9, lines 57-63. 

In considering claim 34, Porras discloses an apparatus comprising: A storage 
medium having stored therein a plurality of programming instructions designed to 
implement a director to receive reporting of information associated with source 
addresses of packets routed through a plurality of routing devices of a network, and to 
determine whether at least some instances of the source addresses are spoof instances 
based on spatial distribution profiles of source addresses and in view of at least one 
reference source address spatial distribution profile, and a processor coupled to the 
storage medium to execute the programming instructions, (col. 2, lines 25-35, also see 
col. 5, lines 36-51). 
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In considering claim 36, the apparatus of Porras further provides a means for 
constructing the spatial distribution profiles. See col. 5, lines 4-36. 

In considering claim 37, the apparatus of Porras further provides a means for 
determining whether each of the spatial distribution profiles is within a resemblance 
tolerance limit when compared to each of the at least one reference source address 
spatial distribution profiles. See col. 5, lines 38-40. 

In considering claim 38, the apparatus of Porras provides a means for 
determining whether selected instances of source addresses of packets are spoof 
source addresses, based on DSAR distribution profiles of source addresses in view of a 
reference source address DSAR distribution profile. See col. 5, lines 36-51. 

In considering claim 39, the apparatus of Porras further provides a means for 
constructing the DSAR distribution profiles. See col. 5, lines 4-36. 

In considering claim 40, the apparatus of Porras further provides a means for 
determining whether each of the DSAR distribution profiles is within a resemblance 
tolerance limit when compared to each of the at least one reference source address 
DSAR distribution profiles. See col. 5, lines 38-40. 
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In considering claim 41 , the apparatus of Porras provides a means for 
determining whether selected instances of source addresses of packets are spoof 
source addresses, based on migration distribution profiles of source addresses in view 
of a reference source address migration distribution profile. See col. 5, lines 36-51. 

In considering claim 42, the apparatus of Porras further provides a means for 
constructing the migration distribution profiles. See col. 5, lines 4-36. 

In considering claim 43, the apparatus of Porras further provides a means for 
determining whether each of the migration distribution profiles is within a resemblance 
tolerance limit when compared to each of the at least one reference source address 
migration distribution profiles. See col. 5, lines 38-40. 

In considering claim 44, the apparatus of Porras provides a means for 
determining whether selected instances of source addresses of packets are spoof 
source addresses, based on timing distribution profiles of source addresses in view of a 
reference source address timing distribution profile. See col. 5, lines 36-51. 

In considering claim 45, the apparatus of Porras further provides a means for 
constructing the timing distribution profiles. See col. 5, lines 4-36. 
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In considering claim 46, the apparatus of Porras further provides a means for 
determining whether each of the timing distribution profiles is within a resemblance 
tolerance limit when compared to each of the at least one reference source address 
timing distribution profiles. See col. 5, lines 38-40. 

In considering claim 47, the method of Porras teaches instructions designed to 
be able to determine whether filtering actions are to be taken amongst particular routing 
devices. See col. 9, lines 57-63. 

In considering claim 48, it is inherent in the method of Porras that the 
programming instructions are designed to take into consideration whether packets of 
non-spoof instances of a source address having instances deemed to be spoof source 
addresses are likely to be routed in the network. See col. 9, lines 57-63. 

(10) Response to Argument 

With regards to independent claims 1 and 15, Appellants acknowledge on page 3 
of the appeal brief that Examiner's rejection to claims 1 and 15 under 35 U.S.C. 102(e) 
was proper, and claims 1 and 15 were anticipated by Porras. 

With regard to claim 2, Appellants argue on pages 3-4 of the appeal brief, that 
the teachings of Porras do not show the determination of whether routed packets have 
spoofed source addresses is made based upon spatial distribution profiles. 
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In response, Examiner submits that broadest reasonable interpretation was given 
to claim 2. In light of Appellants disclosure, and without reading teachings of the 
disclosure into the claims, Examiner interpreted "spatial distribution profiles" as profiles 
generated from the "continuous measures" taught by Porras, (Porras, col. 5, lines 36- 
51, also see col. 6, lines 37-58). Porras teaches continuous measures assuming values 
from a continuous or ordinal set. Porras further gives examples of continuous 
measures including volume of data transfers over a period of time, and network traffic 
measures, (Porras, col. 5, line 65 through col. 6, line 19), and basing measures on 
source addresses, (Porras, col. 5, lines 15-20, also see col. 14, lines 7-18). Examiner 
therefore maintains a spatial distribution profile may be interpreted as a profile 
generated from the continuous measures taught by Porras, since one of ordinary skill in 
the art, in light of Appellants specification, and without reading the teachings of the 
specification into the claims, would consider the measuring of the number of packets 
transmitted over a network to be a form of spatial distribution. 

With regard to claim 16, Appellants argue on page 4 of the appeal brief, that 
claim 16 is patentable for reasons similar to those set forth relative to claim 2. 

In response, Examiner maintains the teachings of Porras read over Appellants 
claimed invention for reasons previously mentioned with regards to claim 2. 

With regard to claim 34, Appellants argue on page 4 of the appeal brief, that 
claim 34 is patentable for reasons similar to those set forth relative to claim 2. 
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In response, Examiner maintains the teachings of Porras read over Appellants 
claimed invention for reasons previously mentioned with regards to claim 2. 

With regard to claim 3, Appellants argue on pages 4-5 of the appeal brief, that 
Porras further fails to specify a profile as comprising exemplary or historical profiles. 

In response, Examiner submits the cited passage in the teachings of Porras 
clearly disclose profiles comprising exemplary or historical profiles. As mentioned 
previously, Examiner interpreted Appellants claimed spatial distribution profile to be a 
profile generated from the continuous measures taught by Porras. In the passage cited 
by the Examiner, Porras teaches a profile engine using scores to determine how close a 
profile, such as a profile generated from a continuous measure, corresponds to a 
historical profile, (Porras, col. 5, lines 38-40). Porras further teaches that such a 
determination is used to detect anomalies (i.e. spoofed source address) in network 
activity, (Porras, col. 6, line 59 through col. 7, line 3, also see col. 14, lines 7-18). 

With regard to claims 17 and 36, Appellants argue on page 5 of the appeal brief, 
that claims 17 and 36 are patentable for reasons similar to those set forth relative to 
claim 3. 

In response, Examiner maintains the teachings of Porras read over Appellants 
claimed invention for reasons previously mentioned with regards to claim 3. 
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With regard to claims 18 and 37, Appellants argue on page 5 of the appeal brief, 
that claims 18 and 37 are patentable for reasons similar to those set forth relative to 
claim 3, and further, Porras fails to suggest resemblance tolerances. 

In response, Examiner maintains the teachings of Porras read over Appellants 
claimed invention for reasons previously mentioned with regards to claim 3. Further 
Examiner maintains Porras teaches resemblance tolerances because as previously 
mentioned, Porras teaches comparing an observed profile with a historical profile to 
determine a resemblance between the observed profile and the historical profile in order 
to detect anomalies in network activity, (Porras, col. 5, lines 38-40, col. 6, line 59 
through col. 7, line 3, also see col. 14, lines 7-18). 

With regard to claim 19, Appellants argue on pages 5-6 of the appeal brief, that 
claim 19 is patentable for reasons similar to those set forth relative to claim 3. 

In response, Examiner maintains the teachings of Porras read over Appellants 
claimed invention for reasons previously mentioned with regards to claim 3. 

With regard to claim 4, Appellants argue on page 6 of the appeal brief, that the 
teachings of Porras do not show determining whether a packet has a spoofed source 
address based on a destination source address range distribution profile. 

In response, Examiner submits that broadest reasonable interpretation was given 
to claim 4. In light of Appellants disclosure, and without reading teachings of the 
disclosure into the claims, Examiner interpreted "destination source address range 
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profiles" as profiles generated from the "categorical measures" taught by Porras, 
(Porras, col. 5, lines 36-51, also see col. 6, lines 37-58). Porras teaches categorical 
measures assuming values from a discrete, non-ordered set of possibilities. Porras 
further gives examples of categorical measures including network source and 
destination addresses, (Porras, col. 5, lines 52-59). Examiner therefore maintains a 
destination source address range distribution profile may be interpreted as a profile 
generated from the categorical measures taught by Porras, since a set of network 
source and destination addresses includes a distribution range of destination source 
addresses. 

With regard to claim 20, Appellants argue on page 6 of the appeal brief, that 
claim 20 is patentable for reasons similar to those set forth relative to claim 4. 

In response, Examiner maintains the teachings of Porras read over Appellants 
claimed invention for reasons previously mentioned with regards to claim 4. 

With regard to claims 21 and 29, Appellants argue on page 6 of the appeal brief, 
that claims 21 and 29 are patentable for reasons similar to those set forth relative to 
claim 20. 

In response, Examiner maintains the teachings of Porras read over Appellants 
claimed invention for reasons previously mentioned with regards to claim 20. 
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With regard to claims 22 and 40, Appellants argue on pages 6-7 of the appeal 
brief, that claims 22 and 40 are patentable for reasons similar to those set forth relative 
to claim 20. 

In response, Examiner maintains the teachings of Porras read over Appellants 
claimed invention for reasons previously mentioned with regards to claim 20. 

With regard to claim 38, Appellants argue on page 7 of the appeal brief, that 
claim 38 is patentable for reasons similar to those set forth relative to claim 4. 

In response, Examiner maintains the teachings of Porras read over Appellants 
claimed invention for reasons previously mentioned with regards to claim 4. 

With regard to claim 5, Appellants argue on pages 7 of the appeal brief, that 
Porras further fails to specify a profile as comprising exemplary or historical profiles. 

In response, Examiner submits the cited passage in the teachings of Porras 
clearly disclose profiles comprising exemplary or historical profiles. As mentioned 
previously, Examiner interpreted Appellants claimed source address range distribution 
profile to be a profile generated from the categorical measures taught by Porras. In the 
passage cited by the Examiner, Porras teaches a profile engine using scores to 
determine how close a profile, such as a profile generated from a continuous measure, 
corresponds to a historical profile, (Porras, col. 5, lines 38-40). Porras further teaches 
that such a determination is used to detect anomalies (i.e. spoofed source address) in 
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network activity, (Porras, col. 6, line 59 through col. 7, line 3, also see col. 14, lines 7- 

18) . 

With regard to claim 23, Appellants argue on pages 7-8 of the appeal brief, that 
claim 23 is patentable for reasons similar to those set forth relative to claim 5. 

In response, Examiner maintains the teachings of Porras read over Appellants 
claimed invention for reasons previously mentioned with regards to claim 5. 

With regard to claim 6, Appellants argue on page 8 of the appeal brief, that the 
teachings of Porras do not show the determination of whether routed packets have 
spoofed source addresses is made based upon migration distribution profiles. 

In response, Examiner submits that broadest reasonable interpretation was given 
to claim 6. In light of Appellant's disclosure, and without reading teachings of the 
disclosure into the claims, Examiner interpreted "migration distribution profiles" as 
profiles generated from the "continuous measures" taught by Porras, (Porras, col. 5, 
lines 36-51, also see col. 6, lines 37-58). As previously mentioned, Porras teaches 
continuous measures assuming values from a continuous or ordinal set. Porras further 
gives examples of continuous measures including volume of data transfers over a 
period of time, and network traffic measures, (Porras, col. 5, line 65 through col. 6, line 

19) , and basing measures on source addresses, (Porras, col. 5, lines 15-20, also see 
col. 14, lines 7-18). Examiner therefore maintains a migration distribution profile may be 
interpreted as a profile generated from the continuous measures taught by Porras, since 
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one of ordinary skill in the art, in light of Appellant's specification, and without reading 
teachings of the specification into the claims, would consider a network losing or gaining 
an abnormal volume in packets transmitted across a network to be a form of migration 
distribution. 

With regard to claim 24, Appellants argue on page 8 of the appeal brief, that 
claim 24 is patentable for reasons similar to those set forth relative to claim 6. 

In response, Examiner maintains the teachings of Porras read over Appellants 
claimed invention for reasons previously mentioned with regards to claim 6. 

With regard to claim 41 , Appellants argue on page 8 of the appeal brief, that 
claim 41 is patentable for reasons similar to those set forth relative to claim 6. 

In response, Examiner maintains the teachings of Porras read over Appellants 
claimed invention for reasons previously mentioned with regards to claim 6. 

With regard to claims 25 and 42, Appellants argue on pages 8-9 of the appeal 
brief, that claims 25 and 42 are patentable for reasons similar to those set forth relative 
to claim 6. 

In response, Examiner maintains the teachings of Porras read over Appellants 
claimed invention for reasons previously mentioned with regards to claim 6. 
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With regard to claims 26 and 43, Appellants argue on page 9 of the appeal brief, 
that claims 26 and 43 are patentable for reasons similar to those set forth relative to 
claim 24, and further, Porras fails to suggest resemblance tolerances. 

In response, Examiner maintains the teachings of Porras read over Appellants 
claimed invention for reasons previously mentioned with regards to claim 24. Further 
Examiner maintains Porras teaches resemblance tolerances because as previously 
mentioned, Porras teaches comparing an observed profile with a historical profile to 
determine a resemblance between the observed profile and the historical profile in order 
to detect anomalies in network activity, (Porras, col. 5, lines 38-40, col. 6, line 59 
through col. 7, line 3, also see col. 14, lines 7-18). 

With regard to claim 7, Appellants argue on pages 9 of the appeal brief, that 
Porras further fails to specify a profile as comprising exemplary or historical profiles. 

In response, Examiner submits the cited passage in the teachings of Porras 
clearly disclose profiles comprising exemplary or historical profiles. As mentioned 
previously, Examiner interpreted Appellants claimed migration distribution profile to be a 
profile generated from the continuous measures taught by Porras. In the passage cited 
by the Examiner, Porras teaches a profile engine using scores to determine how close a 
profile, such as a profile generated from a continuous measure, corresponds to a 
historical profile, (Porras, col. 5, lines 38-40). Porras further teaches that such a 
determination is used to detect anomalies (i.e. spoofed source address) in network 
activity, (Porras, col. 6, line 59 through col. 7, line 3, also see col. 14, lines 7-18). 



Application/Control Number: 09/777,550 
Art Unit: 2151 



Page 23 



With regard to claim 27, Appellants argue on pages 9-10 of the appeal brief, that 
claim 27 is patentable for reasons similar to those set forth relative to claim 7. 

In response, Examiner maintains the teachings of Porras read over Appellants 
claimed invention for reasons previously mentioned with regards to claim 7. 

With regard to claim 8, Appellants argue on page 10 of the appeal brief, that the 
teachings of Porras do not show the determination of whether routed packets have 
spoofed source addresses being made based upon timing distribution profiles. 

In response, Examiner submits that broadest reasonable interpretation was given 
to claim 8. In light of Appellant's disclosure, and without reading the teachings of the 
disclosure into the claims, Examiner interpreted "timing distribution profiles" as profiles 
generated from the "continuous measures" taught by Porras, (Porras, col. 5, lines 36- 
51, also see col. 6, lines 37-58). As previously mentioned, Porras teaches continuous 
measures assuming values from a continuous or ordinal set. Porras further gives 
examples of continuous measures including inter-event time, (Porras, col. 5, line 65 
through col. 6, line 19), and basing measures on source addresses, (Porras, col. 5, lines 
15-20, also see col. 14, lines 7-18). Examiner therefore maintains a timing distribution 
profile may be interpreted as a profile generated from the continuous measures taught 
by Porras, since one of ordinary skill in the art, in light of Appellant's specification, and 
without reading the teachings of the specification into the claims, would consider 
measuring time between consecutive events to be a form of timing distribution. 
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With regard to claims 28 and 44, Appellants argue on page 10 of the appeal 
brief, that claims 28 and 44 are patentable for reasons similar to those set forth relative 
to claim 8. 

In response, Examiner maintains the teachings of Porras read over Appellants 
claimed invention for reasons previously mentioned with regards to claim 8. 

With regard to claims 29 and 45, Appellants argue on pages 10-11 of the appeal 
brief, that claims 29 and 45 are patentable for reasons similar to those set forth relative 
to claim 8. 

In response, Examiner maintains the teachings of Porras read over Appellants 
claimed invention for reasons previously mentioned with regards to claim 8. 

With regard to claims 30 and 46, Appellants argue on page 1 1 of the appeal 
brief, that claims 30 and 46 are patentable for reasons similar to those set forth relative 
to claim 8, and further, Porras fails to suggest resemblance tolerances. 

In response, Examiner maintains the teachings of Porras read over Appellants 
claimed invention for reasons previously mentioned with regards to claim 8. Further 
Examiner maintains Porras teaches resemblance tolerances because as previously 
mentioned, Porras teaches comparing an observed profile with a historical profile to 
determine a resemblance between the observed profile and the historical profile in order 
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to detect anomalies in network activity, (Porras, col. 5, lines 38-40, col. 6, line 59 
through col. 7, line 3, also see col. 14, lines 7-18). 

With regard to claim 9, Appellants argue on page 1 1 of the appeal brief, that 
Porras further fails to specify a profile as comprising exemplary or historical profiles. 

In response, Examiner submits the cited passage in the teachings of Porras 
clearly disclose profiles comprising exemplary or historical profiles. As mentioned 
previously, Examiner interpreted Appellants claimed timing distribution profile to be a 
profile generated from the continuous measures taught by Porras. In the passage cited 
by the Examiner, Porras teaches a profile engine using scores to determine how close a 
profile, such as a profile generated from a continuous measure, corresponds to a 
historical profile, (Porras, col. 5, lines 38-40). Porras further teaches that such a 
determination is used to detect anomalies (i.e. spoofed source address) in network 
activity, (Porras, col. 6, line 59 through col. 7, line 3, also see col. 14, lines 7-18). 

With regard to claim 10, Appellants argue on page 12 of the appeal brief, that the 
teachings of Porras do not show determining whether filtering actions are to be taken to 
filter out packets with source addresses that are deemed to be spoofed source 
addresses and further how those filtering actions should be distributed among the 
routing devices. 

In response, Examiner agrees with Appellants analysis of the teachings of Porras 
in the passage cited by the Examiner where Porras describes a resolver (20) that issues 
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intrusion/suspicion reports, and further describes how analysis engines may be 
reconfigured to change "the collection method's filtering semantics when necessary", 
(Porras col. 9, lines 57-63). Nevertheless, Examiner maintains the cited teachings of 
Porras imply such monitoring is done for such purposes as determining whether filtering 
actions are to be taken to filter out packets with source addresses that are deemed to 
be spoofed source addresses and further how those filtering actions should be 
distributed among routing devices. Evidence of this is found throughout the teachings 
of Porras. For example, Porras teaches using the monitors for routing devices, (col. 3 t 
lines 42-45). Porras further teaches the monitors being used to detect address 
spoofing, (col. 7, lines 43-54, also see col. 14, lines 7-18). Still further, Porras teaches 
interfaces to the monitors that provides a subscription service to receive reports from 
the monitoring and allows for configuring the monitoring, (col. 8, line 66 through col. 9, 
line 7). 

With regard to claim 11, Appellants argue on page 13 of the appeal brief, that the 
teachings of Porras further do not show the director taking into consideration in making 
its determination whether filtering actions should be taken based on where packets of 
non-spoofed instances of source address having instances deemed to be spoofed 
source addresses are likely to be routed in the network. 

In response, Examiner maintains Porras teaches the director taking into 
consideration in making its determination whether filtering actions should be taken 
based on where packets of non-spoofed instances of source address having instances 
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deemed to be spoofed source addresses are likely to be routed in the network for 
reasons previously indicated. Furthermore, Examiner maintains it is inherent in the 
teachings of Porras that the director takes into consideration in making its determination 
whether filtering actions should be taken based on where packets of non-spoofed 
instances of source address having instances deemed to be spoofed source addresses 
are likely to be routed in the network because Porras teaches detecting address 
spoofing, and taking into consideration in making a determination whether filtering 
actions should be taken based on where packets of non-spoofed instances of source 
address having instances deemed to be spoofed source address are likely in a network 
is a part of detecting address spoofing, (Porras, col. 7, lines 43-54, also see col. 14, 
lines 7-18). 
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(11) Related Proceeding(s) Appendix 

No decision rendered by a court or the Board is identified by the examiner in the 
Related Appeals and Interferences section of this examiner's answer. 

For the above reasons, it is believed that the rejections should be sustained. 
Respectfully submitted, 

Hassan Phillips ^ / ffy * 
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